Re: capturing on both interfaces simultaneously

[Guy Harris <guy () alum mit edu>]

On Dec 10, 2011, at 12:58 PM, abhinav narain wrote:

> So,  I can do select + pcap_dispatch to read on two interfaces without even
> using threads.
>
> I read select is slow for monitoring.

Possibly.  If you don't care about portability, you could use epoll():

        http://kernel.org/doc/man-pages/online/pages/man7/epoll.7.html

> But with only two interfaces, it should not be a problem.

I think at least one of the scalability issues with select() is that the set of FDs to be monitored is copied on every 
call; for two FDs that shouldn't be too bad.-
This is the tcpdump-workers list.
Visit https://cod.sandelman.ca/ to unsubscribe.